Cybersecurity and Digital Resilience
The Global Centre for Risk and Innovation (GCRI)
Power grids, water systems, hospitals, payment networks and transport rely on information and operational technology that attackers target for disruption, extortion or espionage. Incidents can stop physical services and endanger lives. This page sets out how cyber threats reach critical services, why operational technology is different, how resilience is measured, and what evidence serves the operators, regulators and national agencies responsible.
GCRI · In development · service level R0
Critical infrastructure cybersecurity is the protection of the information and operational technology behind power, water, health, finance and transport. Control systems are long-lived and hard to patch, IT and OT have converged, and incidents can stop physical services, so segmentation, monitoring and manual fallback matter.
For critical service cyber, in GCRI's spatial-intelligence reading, the map opens on night lights, true-colour imagery and population density with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For critical service cyber, in GCRI's spatial-intelligence reading, the map opens on night lights, true-colour imagery and population density with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Critical service cyber · Critical service A · Incident IR-8651
| IDP-01 | Identity | Compromised | Identity platform |
| APP-07 | Payments API | Isolated | Service owner |
| DB-02 | Customer data | Forensics | Data owner |
| BK-01 | Backups | Clean | Operations |
Cyber-physical lifelines and safety. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Control systems run for decades, often on old software that cannot be patched easily. They were designed for reliability and isolation, not for connected networks.
Remote access, cloud monitoring and business integration connect control networks to corporate IT. Attacks that begin in IT can reach operations or force precautionary shutdowns.
Ransomware on a hospital or pipeline operator can stop care or supply even without touching control systems, because operations depend on IT for scheduling, billing and records.
National agencies report that some state-linked actors gain access to infrastructure networks in advance, to be able to disrupt them in a crisis.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Industrial control system | A system of controllers and software that monitors and controls industrial processes. |
| IT and OT convergence | The growing connection of business IT networks with operational technology networks. |
| Manual fallback | The ability to operate a physical process without its digital control systems. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Incidents reported by critical sectors | count by sector | annual | Mandatory incident reporting | OFFICIAL |
| Internet-exposed industrial control devices | count | monthly | Internet scanning studies | OBSERVED |
| Operators with tested manual fallback | percent of operators | per assessment | Regulator assessments | REPORTED |
| Service outage hours caused by cyber incidents | hours | per incident | Incident reports | OBSERVED |
| Security advisories for industrial control systems | count | monthly | National advisories | OFFICIAL |
| IT and OT network segmentation | percent of sites segmented | per assessment | Operator assessments | DECLARED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| CISA industrial control systems advisories | Vulnerabilities and mitigations for control system products | Public domain, US government |
| ENISA annual reports on NIS incidents | Aggregated incident reports from essential sectors | Public, ENISA terms |
| Joint advisories from national cyber agencies on threats to critical infrastructure | Assessments of actor behaviour and mitigations | Public, terms per agency |
| IEC 62443 series | Security requirements for industrial automation and control systems | Licensed standards, purchase required |
| Published post-incident reviews from operators and regulators | Causes and effects of critical service incidents | Public records, terms per publisher |
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Critical infrastructure operators | How to segment, monitor and keep manual fallback for operations | Baseline reviews; dependency maps |
| Sector regulators | What cyber requirements and testing to set | Incident reports; assessment evidence |
| National cyber agencies | Where to focus support and advisories | Exposure scans; incident trends |
In most information systems, the worst outcome of a breach is data loss or downtime. In cyber-physical systems, the worst outcome can be a flood, a blackout, a contaminated water supply or harm to patients. Operational technology was often designed for isolated networks and long lifetimes, and connecting it to corporate and internet networks has created exposures that conventional IT security does not fully address.
Cyber-physical risk depends on how digital control, physical processes and human operators interact.
Programmable controllers, supervisory systems and field devices that run physical processes, often with long lifetimes and limited ability to patch.
Independent safety systems, physical interlocks and manual overrides that limit harm even when digital control is compromised.
Operators' ability to detect abnormal behaviour and fall back to manual operation is often the last line of defence.
Security measures that work in office networks can be harmful in control systems. Aggressive scanning can crash older devices, automatic updates can interrupt continuous processes and remote access added for convenience can open new paths for attackers. Critical service cyber therefore needs engineers who understand both the process and the threat.
Starts from the worst physical outcomes and works back to the digital paths that could cause them. It requires deep process knowledge.
Combines hazard analysis with threat modelling, using software and safety-critical systems engineering and reliability and resilience engineering. Methods are maturing and not yet standard across sectors.
Public reports of attacks on industrial systems are few and often incomplete, which limits statistical analysis.
Laboratory testbeds reproduce control systems for testing. They cannot capture every real configuration.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.